knso/Webklar-Kundenbereich
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Kundenansicht: zentraler Waechter (2 h, Verwechslungsschutz, Schreibsperre ausser News)

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
ClaudeandClaude Opus 5.5 committed 2026-10-01 19:29:47 +00:00
1 parent 1cd776a2ee
commit 25f3c1df4d
5 files changed
+250 -12
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

server/routes/news.js
+3 -11
View File
@@ -34,13 +34,6 @@ function writeRateLimited(customerId) {
return list.length > MAX_WRITES_PER_HOUR
}
function rejectViewAs(req, res, next) {
if (req.session.viewAs) {
return res.status(403).json({ error: 'Im "Als Kunde ansehen"-Modus kann nichts geändert werden.' })
}
return next()
}
function limitWrites(req, res, next) {
if (writeRateLimited(getSessionCustomerId(req))) {
return res.status(429).json({ error: 'Zu viele Änderungen in kurzer Zeit. Bitte versuch es in einer Stunde wieder.' })
@@ -82,7 +75,7 @@ router.get('/', requireSession, withProject(), async (req, res) => {
}
})
router.post('/', requireSession, rejectViewAs, withProject(), limitWrites, async (req, res) => {
router.post('/', requireSession, withProject(), limitWrites, async (req, res) => {
try {
const post = await createPost({ customerId: getSessionCustomerId(req), projectId: req.projectId, input: req.body })
res.status(201).json(post)
@@ -95,7 +88,6 @@ router.post('/', requireSession, rejectViewAs, withProject(), limitWrites, async
router.post(
'/image',
requireSession,
rejectViewAs,
withProject(),
(req, res, next) => {
if (newsImageRateLimited(getSessionCustomerId(req))) {
@@ -131,7 +123,7 @@ router.get('/image/:projectId/:file', requireSession, async (req, res) => {
}
})
router.patch('/:id', requireSession, rejectViewAs, withProject(), limitWrites, async (req, res) => {
router.patch('/:id', requireSession, withProject(), limitWrites, async (req, res) => {
try {
const post = await updatePost({ customerId: getSessionCustomerId(req), projectId: req.projectId, id: req.params.id, input: req.body })
res.json(post)
@@ -140,7 +132,7 @@ router.patch('/:id', requireSession, rejectViewAs, withProject(), limitWrites, a
}
})
router.delete('/:id', requireSession, rejectViewAs, withProject(), limitWrites, async (req, res) => {
router.delete('/:id', requireSession, withProject(), limitWrites, async (req, res) => {
try {
await deletePost({ customerId: getSessionCustomerId(req), projectId: req.projectId, id: req.params.id })
res.status(204).end()